CVE-2026-46388: medium-severity vulnerability in osquery
osquery: Unprivileged users can temporarily read file carve contents
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 4.4epss 0.1%
osquery is a SQL powered operating system instrumentation, monitoring, and analytics framework. Prior to 5.23.1, an unprivileged attacker can read the contents of an osquery file carve until the carve completes and the temporary files are deleted because in-progress carve directories are not created with private permissions. If the carve targets a directory that the attacker controls, arbitrary file reads are possible, such as sensitive local files. This issue is fixed in version 5.23.1.
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N
Affected products
osquery · osqueryRelated CVEs — osquery
In the same product, most dangerous first.
CVE-2020-26273MEDIUMsqlite ATTACH allows some filesystem accessEPSS 1.0%CVE-2020-11081MEDIUMosquery susceptible to DLL search order hijacking of zlib1.dllEPSS 0.6%CVE-2026-54000HIGHosquery: Heap buffer overflow in `getProcessCurrentDirectory()` via `processes` table (Windows)EPSS 0.2%CVE-2026-54001HIGHosquery: Heap buffer overflow via `authenticode` table (Windows)EPSS 0.2%